I was just wondering if anyone could explain the differences between pip() and file() when used as kernel log sources. For example the documentation suggests you would use the following statement to collect kernel logs: source s_file { file("/proc/kmsg"); }; Most examples of syslog-ng.conf files I have seen have the following statement: source s_pipe { pipe("/proc/kmsg"); }; Is there any difference between the two? Is one better than the other? Any help much appreciated. Thanks James Turnbull